arc-project-deploy-portfolio-sync
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
scripts/project_status_check.shto executenpm run build/lintorbun run build/lintwithin the target project directory. This is standard behavior for deployment automation and is controlled by the agent's local environment context. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from project source files (such as
package.jsonandREADME.md) and portfolio repository HTML files to generate status updates and portfolio entries. - Ingestion points: Reads project configuration files and existing portfolio HTML files in the
andrewsolomon.devdirectory. - Boundary markers: None explicitly defined in the prompt instructions; the skill relies on the structured Output Contract for logical separation.
- Capability inventory: Subprocess execution for builds, local file system writes for portfolio updates, and network access for Vercel deployment commands.
- Sanitization: The included shell scripts use
set -euo pipefailto prevent execution on errors, though the final content interpolation depends on the agent's internal safety mechanisms.
Audit Metadata